normdiff

Data (Use and Access) Act 2025 amends UK GDPR provisions on data access and processing rights

Original title: Data (Use and Access) Act 2025 effect on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)

The Data (Use and Access) Act 2025 has come into effect on 23 March 2026, introducing amendments to Regulation (EU) 2016/679 as retained in UK law (UK GDPR). These amendments modify provisions governing how organisations must facilitate data access for individuals and other stakeholders, and adjust controller responsibilities in data processing activities. Organisations subject to UK GDPR will need to review their data handling practices, contractual terms with data subjects, and internal procedures to ensure compliance with the new requirements.

What changed

  • The Data (Use and Access) Act 2025 introduces new mechanisms for data access that extend beyond traditional subject access requests, potentially requiring controllers to provide data in standardised formats and to third parties designated by data subjects
  • Amendments clarify or expand controller obligations regarding data portability and the provision of personal data in machine-readable formats, affecting how organisations structure their data management systems
  • The Act modifies provisions relating to the rights of data subjects and potentially introduces obligations for controllers to facilitate data reuse in specific contexts
  • Changes may affect the legal basis and procedural requirements for processing personal data, particularly where data is accessed for purposes of data portability or sharing with third parties

Who is affected

All UK organisations processing personal data under UK GDPR, including data controllers and processors across all sectors; particularly affected are organisations that hold large volumes of personal data or operate data platforms, as well as those in regulated industries with specific data handling requirements. The amendments apply broadly across the UK jurisdiction.

Summary generated by a language model; the official text prevails. Not legal advice.

More changes in GDPR